CVE-2026-52812 Details
Description
Gogs is an open source self-hosted Git service. Prior to 0.14.3, Git LFS storage is content-addressed by OID alone (<LFS-root>/<oid[0]>/<oid[1]>/<oid>) but per-repo authorization lives in the lfs_object table keyed (repo_id, oid). serveUpload skips re-uploading when the OID file already exists on disk and inserts a new (repo_id, oid) row pointing at it without verifying the request body hashes to the OID being claimed. Any user with write access to one repo can bind their repo to an OID owned by a private repo and download the original bytes via their own download endpoint. This vulnerability is fixed in 0.14.3.
A vulnerability in Gogs prior to version 0.14.3 allows for cross-repository disclosure of Git Large File Storage (LFS) object contents. This issue arises because LFS storage is addressed by Object ID (OID) alone, while per-repository authorization is managed through the lfs_object table, which is keyed by repository ID and OID. The vulnerability occurs in the serveUpload function, which skips re-uploading existing OID files without verifying that the request body hashes match the claimed OID. As a result, a user with write access to one repository can bind their repository to an OID owned by a private repository and download the original content through their own download endpoint.
Users can update to Gogs version 0.14.3 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 24, 2026CISA-ADP
Assessed Jun 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/gogs/gogs/security/advisories/GHSA-6p9m-q3jp-47h4 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/gogs/gogs/commit/f35a767af74e05342bafc6fdda02c791816426f8 | [email protected] | Source CodeVendor |
| https://github.com/gogs/gogs/pull/8333 | [email protected] | Issue TrackingVendor |
| https://github.com/gogs/gogs/releases/tag/v0.14.3 | [email protected] | Release NotesVendor |
| https://github.com/gogs/gogs/security/advisories/GHSA-6p9m-q3jp-47h4 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-345 | Insufficient Verification of Data Authenticity | [email protected] |
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Gogs | < 0.14.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 26, 2026 | CVE Modified | CISA-ADP |
| Jun 24, 2026 | New CVE Received | [email protected] |